Incorrect Authorization

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Incorrect Authorization due to insufficient permission checks on admin content pages. An attacker can access unpublished content by leveraging add...

Incorrect Authorization

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Incorrect Authorization due to insufficient permission checks on admin content pages. An attacker can access unpublished content by leveraging add...

CVE-2026-85599

Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabilities in the lorem tag parameter and details summary parameter that are written to rendered pages without escaping. Attackers with page-edit access can inject arbitrary HTML and JavaScript that executes in the browser...

CVE-2026-85599 Grav Shortcode Core before 6.2.5 Stored XSS via unescaped parameters

Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabilities in the lorem tag parameter and details summary parameter that are written to rendered pages without escaping. Attackers with page-edit access can inject arbitrary HTML and JavaScript that executes in the browser...

CVE-2026-85599

Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabilities in the lorem tag parameter and details summary parameter that are written to rendered pages without escaping. Attackers with page-edit access can inject arbitrary HTML and JavaScript that executes in the browser...

CVE-2026-85599

Grav Shortcode Core before version 6.2.5 is vulnerable to stored XSS in two shortcode parameters: the [lorem] tag parameter and the [details] summary parameter. These values are written to rendered pages without escaping, allowing an attacker with page-edit access to inject arbitrary HTML and Jav...

CVE-2026-85599 Grav Shortcode Core before 6.2.5 Stored XSS via unescaped parameters

Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabilities in the lorem tag parameter and details summary parameter that are written to rendered pages without escaping. Attackers with page-edit access can inject arbitrary HTML and JavaScript that executes in the browser...

EUVD-2026-71022

Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabilities in the lorem tag parameter and details summary parameter that are written to rendered pages without escaping. Attackers with page-edit access can inject arbitrary HTML and JavaScript that executes in the browser...

CVE-2026-85587

phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to read draft and inactive content. Attackers with only add permissions can access news edit and FAQ translate endpoints to view unpublished content invisible to the public...

CVE-2026-85546

MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...

EUVD-2026-70981

MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...

CVE-2026-85546 MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests

MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...

CVE-2026-85546

MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...

CVE-2026-85546 MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests

MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...

CVE-2026-85546 MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests

MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...

CVE-2026-85546

MISP is affected by a cross-site request forgery (CSRF) vulnerability in its sharing group quick-edit functionality. The root cause lies in the __initialiseSGQuickEdit() helper, where the allowMethod(['post']) call was commented out, allowing the addOrg, removeOrg, addServer, and removeServer act...

CVE-2026-75167: Improper Access Control

A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to change the password of arbitrary accounts...

CVE-2026-85587: Incorrect Authorization

phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to read draft and inactive content. Attackers with only add permissions can access news edit and FAQ translate endpoints to view unpublished content invisible to the public...

CVE-2026-85546: Cross-Site Request Forgery (CSRF)

MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...

PT-2026-85455

MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...